Squashing Models for Optical Measurements in Quantum Communication 
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Measurements with photodetectors are naturally described in the infinite dimensional Fock space 
of one or several modes. For some measurements a model has been postulated which describes 
the full mode measurement as a composition of a mapping (squashing) of the signal into a small 
dimensional Hilbert space followed by a specified target measurement. We present a formalism to 
investigate whether a given measurement pair of full and target measurements can be connected 
by a squashing model. We show that a measurement used in the BB84 protocol does allow a 
squashing description, although the corresponding six-state protocol measurement does not. As a 
result, security proofs for the BB84 protocol can be based on the assumption that the eavesdropper 
forwards at most one photon, while the same does not hold for the six-state protocol. 

PACS numbers: 42.50.Ex, 03.67Dd, 03.67.Hk, 42.79.Sz 



Detection devices play an important role in quantum 
communication protocols. In the theoretic design of these 
protocols, signals are often thought of as qubits, and 
therefore low-dimensional Hilbert spaces only need to be 
considered. In optical implementations, the signals are 
realized by photons, which are naturally described by 
the Fock spaces of spatio-temporal modes. Our goal is 
to determine how one can reduce the large-dimensional 
description of optical measurements of these modes to a 
particular lower-dimensional one. Our insight will pro- 
vide a powerful tool to ease the analysis of optical imple- 
mentations of quantum communication protocols. 

A typical measurement in quantum communication is 
the one used in the BB84 QKD protocol [if, in which 
the incoming light is split by a polarizing beam-splitter, 
which can be oriented either along the horizontal/vertical 
basis (labelled as z) or in the +45/-45 degree basis (la- 
belled as x) . The signal is then sent to a threshold detec- 
tor which cannot resolve the number of photons by which 
they are triggered. This measurement can be described 
as a single Positive Operator Valued Measure (POVM) 
with non-commuting POVM elements if the basis choice 
is done at random with some fixed probabilities. It has 
been postulated that there exists a squashing model for 
this set-up, which first maps (squashes) the incoming sig- 
nal to a one-photon polarization Hilbert space, followed 
by the same BB84 measurement. A recent important 
security proof @ is based on this detector property. 

In this Letter, we define a squashing model and lay 
out a framework to determine whether a given detection 
device allows a squashing model. We then prove for the 
BB84 measurement that a squashing model exists. Sur- 
prisingly, the corresponding measurement in the six-state 
protocol [1, 0] does not admit a squashing model. More 
details of these results will be presented in a future paper. 

First, we will define a squashing model more precisely. 
A full measurement, Fm, described by a POVM with 



elements F$ defined on a large (possibly infinite dimen- 
sional) Hilbert space M is said to admit a squashing 
model with respect to a target measurement, Fq, with 
POVM elements Fq' on a smaller dimensional Hilbert 
space Q if a squashing map A from M to Q exists, such 
that the composition of the squashing map and the mea- 
surement on Q is statistically equivalent to the measure- 
ment on system M. In other words, the two measurement 
models in Fig.[T]must act identically for any input signal. 

The measurement description via the POVM elements 
FjJ and Fq need not correspond to the basic events by 
the detectors, such as the pattern of detector clicks, but 
can involve some post-processing. For example, in the 
optical implementation of the BB84 measurement above, 
double clicks occur if both detectors fire due to a multi- 
photon input, while after squashing, at most one photon 
is contained in the signal and so no double clicks can 
occur. Therefore, to match the number of possible out- 
comes, we can choose to map double clicks of the full 
measurement randomly to the single-click event of one 
of the two detectors. This mapping has been introduced 
before in the security analysis of QKD [H, Q . 

In the context of QKD, one typically assumes the cal- 
ibrated device scenario in which the detection device is 
trusted and known. Then if a squash model exists, the 
corresponding squashing map can become part of the 
eavesdropper's (Eve's) attack. Therefore we can assume, 
without loss of generality, that Eve sends a signal in the 
Hilbert space Q to the receiver, Bob. As an example, 
many security proofs assume that Eve forwards polarized 
single photons (qubits) or vacuum states to the receiver. 
If a given full optical implementation of a polarization 
measurement has a squash model connecting it to the sin- 
gle photon polarization measurement assumed in the se- 
curity proof, then this proof is also valid for the full opti- 
cal implementation of the protocol. Additionally, squash- 
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FIG. 1: The full measurement Fm (above) has a general op- 
tical input pi n , which is first measured by a receiver's phys- 
ical detector B, followed by classical post-processing. The 
squashed measurement (below) has the same general optical 
input pi n , which is then squashed by a map A to a smaller 
Hilbert space, followed by a fixed physical measurement Fq. 
It is required that both of these measurements produce the 
same output statistics for all pin- 



ing the detection to a finite-dimensional system makes it 
possible to use the fast converging de Finetti theorems 
of Renner [7| on the level of the squashed system, even if 
the original full system is infinite dimensional. 

Notice that the existence of a squashing model for a 
given full measurement Fm and target measurement Fq 
is the question of the existence of a particular squasher 
connecting these measurements. Any valid squasher 
must be a trace preserving completely positive map, A, 
and can be described by a set of Kraus operators {^4fc}, 
which obey J^k A\.Ak = 1m- The statistical equivalence 
of the full measurement Fm and concatenation of A and 
Fq can be stated formally as 
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where pi n is the density matrix of the incoming signal. 
We require Eqn. ([1]) to hold for all incoming signals pi n , 
which is fulfilled if and only if 
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holds. That is, the adjoint squashing map At with Kraus 
operators A\ map each qubit POVM operator to the cor- 
responding POVM operator for the mode detector. The 
adjoint map is again a completely positive map. It is not 
necessarily trace preserving, but it is unital. 

The question for the existence of a suitable adjoint 
squashing map At has been formulated as the search 



for a suitable set of Kraus operators {^1}- As the 
Kraus operators are not unique, we reformulate the con- 
dition Eqn. {2J using the Choi- Jamiolkowski isomorphism 
[H, 0|. It relates the map At to a bipartite operator 
r on a duplicated output Hilbert space QQ' by ap- 
plying the map to half of a maximally entangled state 
\i>+) = l/VdJ2Li\i)Q\i)Q>, where d = dim(QQ'), by 
t = A^ (gi id From this representation one 

can form the transfer matrix t r by reordering the coef- 
ficients via (k,k'\T R \l,l'} = (k,l\r\k' ,1') . Given an op- 
erator O = Y^ij we introduce its vector no- 
tation as \0}) = j Oij\i)\j), and so we can write 
|At(0))) = t r \0)). In this formulation, the search for a 
squashing model for a full measurement Fm and a target 
measurement Fq is the search for a map t such that 
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(k,k'\T R \l,l') = (k,l\r\k' ',/'), 

T f = T > 0. 



(3a) 
(3b) 
(3c) 



Here, r corresponds to the adjoint map At. The 
constraint that At be unital, and therefore A trace- 
preserving, is already contained in the above conditions, 
as the POVM elements on M and Q each add up to the 
identity operator in their respective Hilbert spaces, as 
can be easily seen in the formulation of Eqn. ([2]) . Overall, 
we have reformulated the search for a suitable squashing 
operation as the search for a positive semidefinite oper- 
ator t that satisfies a fixed number of linear constraints, 
which can be efficiently solved using convex optimiza- 
tion. Searching for completely positive maps using these 
techniques has been used, for example, in ToL 111]. 

To simplify the search for the appropriate squashing 
operation, we can exploit further properties of the phys- 
ical measurement. Typical measurement schemes only 
involve photon counting and hence commute with a quan- 
tum non-demolition (QND) measurement of the total 
number of photons. Consequently, we can decompose 
the squashing operation into a photon number measure- 
ment, followed by the appropriate squashing operation 
conditioned on the outcome of the QND measurement, as 
schematically indicated in Fig. [2] This model now casts 
the problem into finite dimensions, since we only need to 
find the corresponding map for each finite dimensional 
photon number subspace. 

We now consider the situation where we choose as tar- 
get measurements the full measurement restricted to the 
Fock space containing zero or one photon, which is a 

(i) 

qutrit space. As the resulting POVM elements Fq still 
commute with a QND measurement of the total pho- 
ton number, this means that the squashing map can be 
thought of as statistically outputting either no photon or 
one photon. We can now split off the zero-photon case 
easily in the typical scenario, where the full and target 
measurements have the vacuum projection as one POVM 



3 



Vacuum 




FIG. 2: Reduction of the considered squashing operation of 
the BB84 protocol. The squashing operation can be mod- 
elled as a photon number measurement followed by a projec- 
tion measurement onto a 4-dimensional subspace. Depending 
on the outcome of these measurements, one either proceeds 
with a low-dimensional squashing operation or outputs a 
completely mixed qubit state. 



element, while none of the other elements contains a vac- 
uum component. As a result, the squasher will output a 
vacuum signal if and only if the photon number n mea- 
sured in the QND measurement on the input mode space 
is zero. To simplify the presentation, we split these events 
off as a flag (see Fig. sent by the squasher, signalling 
that the input signal contains no photon, and we can 
now restrict ourselves to the case that for n > 1 input 
photons, the squasher outputs exactly one photon in the 
relevant modes, which enters the target measurement. In 
the case of the BB84 and the six-state measurements two 
polarization modes are sufficient to describe the multi- 
photon Hilbert space, so we can assume that for n =/= 
exactly one qubit in the form of a photon with polar- 
ization degrees of freedom is output from the squashing 
operation. In this formulation, the POVM elements F£' 
are now restricted to the full measurements of the one- 
photon Hilbert space, as the vacuum events have been 
replaced by the flag structure of the squasher. 

As a third step, we refine the squasher further by using 
the specific structure of the BB84 measurement. Here 
the full measurement operators on the n-photon subspace 
(n > 1) can be conveniently written as 
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where a 6 {x, z} labels the basis choice for the polar- 
izing beamsplitter, b £ {0, 1} corresponds to the "0" or 
"1" outcome of the detector, and \l,k) a is a two-mode 
Fock state with photon numbers I and k with respect to 
the polarization mode basis a. We define a subspace P 
spanned by the 4 vectors \n, 0) a and |0,n) , and its or- 
thogonal complement P± in the n-photon subspace. A 
QND measurement with respect to these two subspaces 
commutes with each measurement POVM Fq, and thus 
can precede the target detection scheme without loss of 
generality. We can therefore define independent squash- 
ing maps for each of the two sub-spaces, similarly to 
the treatment of the Fock spaces of photon number n. 



It is now easy to identify the squashing map starting 
on the Px-subspace since the POVM elements F^'^ re- 
stricted to this subspace arc given by tp ± /2. An obvious 
choice for the squashing map here is to output the com- 
pletely mixed qubit state, which triggers each POVM 
Fq' 01 ^ with equal probability (see Fig. [2]). This means 
we can now focus on the remaining part of the squashing 
operation, namely for all n > 1 the maps A^ from the 
four-dimensional subspace P of the n-photon Fock space 
to the qubit space. 

If the incoming signal is projected onto the subspace 
P, then cither the map T 0( id or T even will be applied, 
depending on the parity of photon number n. First con- 
sider the case where n > 3, the outcome of the QND 
measurement of the total photon number, is odd; the 
case n = I is trivial. We use the following orthonor- 
mal basis to represent the 4-dimensional subspace P: 
|0i) = |n, 0) z , 102) = |0, n) z , and 
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|<M = & (V2 s=5 (|n,0) a - 10,71),) - lO.n), 



(5) 



where we define C g = \/2™ 9 — 1. The qubit measure- 
ment operators Fq are given by: 
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in the standard basis. The full measurement operators 
Fjj'" from Eqn. ((4]) in the basis given by Eqn. ([5]) are 
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where 1 is the 4x4 identity matrix and we define the 
t = sC\,u = 1 — s. To obtain their 



constants s 



— oi-n + — 



vectorized form {Fq' 01 ^)) and IF^'"')), one needs to con- 
catenate the columns of their matrix form into vectors. 

Now we are ready to impose Eqs. ([3]) on the adjoint 
squashing map. First note that t r maps real vectors 
into real vectors (Eqn. (l3aj) ). and therefore the complex 
conjugate (t r )* also maps these vectors to each other. 
As a result, the average of these two also performs the 
mapping, and so we can assume that t r is a matrix with 
real entries. Also, the target measurement operators, 
\Fq ,0 ^))-> on ly span a three dimensional vector-space, so 
the matrix t r is not completely determined by the linear 
constraints. Keeping the undetermined entries as open 
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parameters a,, we then obtain T dd, which is given by 
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Using the assignment a\ = s, 02 = 0, 03 = t, 04 = 0, 0,5 = 
0,a6 = 1/2 — s for the open parameters ensures that r 
is positive semidefinite. By considering suitable subdc- 
tcrminants it can be shown that these parameters must 
be chosen this way, and therefore the squashing map is 
unique. Further details will be included in a future pa- 
per. Following a similar procedure we can also construct 
the unique adjoint squashing operation for even n > 2. 
Therefore, the squashing operation for the BB84 detector 
with active basis choice and the described post-processing 
exists. 

The six-state protocol adds another measurement di- 
rection to the BB84 setting, which sorts the polariza- 
tion of the incoming photons according to a circular ba- 
sis choice (labelled y). Using the same post-processing 
scheme of the double clicks results in similar measure- 
ment operators as given by Eqn. with a G {x,y,z} 
as well as performing a renormalization. Hence the over- 
all measurement description of the six-state protocol is 
similar to the BB84 case, where the transfer matrix t r 
is now completely determined by the linear constraints, 
as the POVM elements of Fq span the whole opera- 
tor space. However, this measurement device cannot 
be squashed down to the qubit level, since r ^ 0. We 
can verify this statement independent of any of the re- 
ductions introduced earlier: all we need to show is that 
r = A T ® id(\ip + )(ip + \) ^ 0. Since the qubit measure- 
ments of the six-state protocol are complete, the in- 
put operator can be expanded into the basis 
{Fq^ ® <jj}, where the aj are the Pauli operators: 

l^ + XV> + l = \{tQ®t Q >+3 £ (fOM - F$*>)&%\. 

a={x,y,z] 

This decomposition has the advantage that the adjoint 
map A T can be applied directly to the first subsystem by 
using the substitution Fq 1— > F$ , which is clear from 
the properties of the adjoint squasher. This operator 
r has negative eigenvalues, starting in the three photon 
subspace. For example, if one tests the operator with the 
state 

= -±= (|3, 0) Mz <g> |1) Q , - |0, 3) Mi ® |0) Q ,) , (7) 
where \0)qi and \1)q, are canonical orthogonal basis 



states, we find (0_|r|0_) = —1/8. This proves that a 
squashing map for the six-state protocol does not exist. 

To summarize, we have given necessary and sufficient 
linear conditions on a positive operator so that a full 
measurement can be represented by a concatenation of a 
squashing operation and a lower dimensional target mea- 
surement. In application to security proofs of QKD, the 
existence of a squashing model allows a simple qubit- 
based security proof to be lifted to one based on the full 
optical implementation, as is the case for the BB84 mea- 
surement, and any other protocol using the same mea- 
surement. The squashing model for this BB84 measure- 
ment has been independently obtained by Tsurumaru 
and Tamaki [l2j]. In the absence of a squashing model 
such a shortcut is not possible and another method of 
proving security of the full optical scenario has to be 
found, such as for the six-state measurement. Note that 
other post-processing methods of the full measurement 
and target measurements could lead to a squashing model 
for the six-state protocol detector. As the squashing 
property holds for the detection set-up independent of 
the use of the detection device, the method outlined in 
our Letter will help to simplify the analysis in other quan- 
tum communication contexts, including the verification 
of entanglement of optical modes with threshold detec- 
tors. 
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